Phishing attacks continue to be a top concern for small businesses and midsize organisations. In fact, 83% of businesses report being a victim of a phishing attack in the last year alone. This is not particularly surprising, considering that these attacks are straightforward to execute and particularly profitable for those who succeed. But there is good news for IT admins – with a little phishing education and a layered defense, it is possible to protect your organisation from a phishing attack.
What is phishing?
The most common type of phishing attack is when a criminal sends an email pretending to be someone or something they are not, to extract sensitive data from the targets. They often use tactics to elicit fear, pique curiosity, or drive a sense of urgency to compel the target to open an attachment or click a malicious link.
What can be even more effective for a hacker, is to wage a highly-targeted spear-phishing attack – emails that include specific information pertaining to the target. Attackers will often research their target on social media channels like LinkedIn and Facebook to build a profile of their intended victim that will help them craft a tailored message that improves their chances for success.
Defending against phishing attacks
The most successful anti-phishing programmes have four components: Protection, Education, Evaluation, and Reporting. These four steps work together to use your staff as a human shield, enabled by technology. Protecting against phishing requires a layered approach to security that aims to keep users safe on the Internet. Keys to this layered approach include:
• Monitoring and blocking malicious outbound DNS requests to ensure employees are not able to reach bad sites through suspicious links or communicate via command and control channels.
• Scanning tools to ensure that malicious files don’t make it through the network, and endpoint security that can detect and kill malware.
• Cloud sandboxing solutions that allow you to detonate suspicious files in an emulated virtual environment that mimics an authentic endpoint to uncover malicious intent.
• Multi-factor authentication to guard against fraud, impersonation, and credential theft.
Every organisation has their share of happy clickers. And even if only a small percentage of your employees are likely to click on an unsafe link or download an infected attachment, you need to have the right security services in place.
Protecting against phishing with Dolos
We have a range of solutions to help protect your organisation:
- As a first line of defense, inspecting each DNS request to determine which is malicious and which is legitimate can prevent a user’s risky click from turning into a major security incident. DNSWatchGO – provides lightweight, always-on protection against phishing and malware.
- Our Network Security and Endpoint Security Solutions ensure that malicious files don’t infiltrate your network.
- Lost credentials prove to be one of the most effective ways for hackers to breach a network, allowing an attacker to have full access to corporate resources and even impersonate their victim to cause further harm. WatchGuard AuthPoint allows you to control access to assets, accounts, and information using multi-factor authentication.
Contact one of our experienced consultants for a trial or tailored consultation on how these technologies can protect your organisation against phishing.
